Deribit

Is Deribit safe?

For a derivatives exchange, Deribit is one of the better-protected places to hold collateral, mainly because of who owns it now. Coinbase, a US-listed company with audited accounts, bought Deribit in August 2025, and most client assets now sit with Coinbase as custodian. Dubai's Virtual Assets Regulatory Authority (VARA) has supervised it since January 2025 and requires full reserves and segregated client assets. We score it 75/100.

Two things hold it back. It lost $28 million to hackers in 2022, though customers did not pay for it. And its licence comes from a single regulator, with derivatives limited to professional clients in Dubai. The bigger risk for most users is not the exchange: it is leverage. Futures and options can wipe out collateral far faster than any hack.

What changed when Coinbase bought Deribit?

Coinbase completed the purchase of Sentillia B.V., Deribit's parent company, on 14 August 2025. Its quarterly filing with the SEC values the deal at about $4.3 billion at closing, made up of about $721 million in cash and Coinbase shares, with $150 million held in escrow for 15 months against claims.

The practical changes came in 2026. Deribit said in August that about 90% of client assets had been moved to Coinbase, which now acts as its custodian. The same month, VARA granted Deribit FZE a broker-dealer licence, so most spot orders on Deribit now execute on Coinbase Exchange, while Deribit keeps the client interface and its own derivatives order books.

Ownership by Coinbase does not mean Coinbase's licences cover you. Deribit's clients deal with Deribit FZE in Dubai, under Dubai rules. Deribit is not available in the United States.

Can you still check Deribit's reserves?

Not yourself, any more. From 2022 Deribit ran a daily proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary page with a Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary, so each client could see their balance was counted and compare total liabilities with the on-chain balances of Deribit's published wallets. It was one of the more thorough versions in the industry.

On 1 September 2026 Deribit removed that page, saying the method no longer fitted its wallets after the move to Coinbase custody. What remains is the regulatory floor. Under VARA, Deribit must hold reserves of at least 100% of client liabilities, keep client assets separate from its own, have its reserves checked by an outside auditor (Deribit says twice a year) and have its financial statements audited every year. Clients can ask for the audited statements. Coinbase's own accounts, which consolidate Deribit, are audited and filed with the SEC.

That is still a strong position, which is why reserves scores 80. It is a step back in day-to-day transparency, though.

The 2022 hot-wallet hack

Just before midnight UTC on 1 November 2022, attackers drained Deribit's hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary of about $28 million: roughly 691 BTC and 9,080 ETH according to the security firm PeckShield, plus some USDC. Deribit stopped withdrawals, said the loss would be paid from company reserves rather than client funds or its insurance fund, and said about 99% of client funds were in cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary and unaffected. Withdrawals reopened after checks, and clients had to generate new deposit addresses.

Deribit never explained publicly how the attackers got in. Under the rubric, a hack paid in full without loss to clients scores in the 60s and 70s, so security history is 75, about level with Binance's handling of its 2019 hack.

How licensed is Deribit?

Deribit moved its main business from Panama to Dubai and became the first crypto derivatives exchange regulated by VARA at the start of 2025. It holds a VARA licence for exchange services and, since August 2026, a broker-dealer licence. VARA is a dedicated crypto regulator with real rules on reserves, custody and audits.

But it is one regulator. Deribit has no EU MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence, no UK authorisation and does not serve the US, and in Dubai its derivatives are open only to qualified and institutional investors. Offshore derivatives venues such as Bybit and OKX cover more countries with lighter licences; Deribit covers fewer with a stronger owner.

We found no fine or enforcement action against Deribit. In early 2025 it closed accounts held by Russian residents to comply with EU sanctions.

How to use Deribit more safely

1. Size positions so that a sudden 20% to 30% move cannot liquidate you. Leverage, not hacking, is how most derivatives traders lose money.
2. Use a hardware security key or authenticator app for login and withdrawals, and set a withdrawal address allowlist.
3. Create API keys with trading rights only, no withdrawal rights, and restrict them to your own IP addresses.
4. Ask Deribit for its latest audited statements if you hold large collateral there, now that the daily reserves page is gone.

How we scored it

Legal record (85) is the strongest factor: no enforcement found. Licensing (58) is the weakest, because Deribit answers to one regulator and limits derivatives to professional clients. Reserves (80) and custody (78) benefit from VARA's segregation rules and Coinbase's custody, and security history (75) reflects the 2022 hack that Deribit paid for itself.